The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text from external code review sources, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: External data sources include PR threads, CI annotations, and pasted messages ingested in the 'Intake' section (SKILL.md).
Boundary markers: The skill contains a 'Security Model' section that explicitly identifies reviews as 'untrusted inputs' and 'claims to verify, not instructions,' and states that instruction-shaped text does not authorize commands or override guidelines.
Capability inventory: The skill can read repository state via Git, edit project files for fixes, and execute the project's own tests and check tools (SKILL.md, references/records.md).
Sanitization: Each finding must be verified against actual code evidence and project contracts (Step 4) before being accepted for a fix. This evidence-based approach is a key defense against non-factual or malicious claims.
[COMMAND_EXECUTION]: The skill executes local commands to inspect the repository and verify the correctness of its fixes.
Evidence: The references/records.md file defines several read-only Git commands used to anchor the review to the current worktree (e.g., git rev-parse, git status, git diff). Step 7 in SKILL.md requires running the project's own full checks and tests to provide resolution evidence.

cr-received